What staff actually ask about codes of conduct, and what it means

People ask the same questions about every code, in every organization, and each question is a diagnosis. The person asking is telling you which part of the document has not reached them, or has reached them and not been believed.

This article takes the eight questions staff ask most, says what a good answer is, and says what the code has to contain for that answer to be true. Then it turns around and gives the questions the person writing a code should be asking before they start.

What to take away

"Does it apply to the CEO?" is asked because the person has watched something and wants to know if they are allowed to have noticed. The honest answer is a matter of record, not policy.
"Can I report anonymously?" is a question about consequences, not about forms. Answer the question about consequences.
"What if my manager approved it?" is the question the code must answer in writing, or every other rule in it is conditional on the manager's mood.
The author's questions are harder than the staff's. The hardest is "which rule in here am I not prepared to enforce against a top performer?" and it should be answered before the document is published.

Questions from the floor

Does this apply to me if I am a contractor?

The good answer is yes or no, in one word, followed by how. If yes, it is in your engagement terms, and here is the clause. If no, here is what applies to you instead. The failing answer is "the code applies to everyone who works with us"; the contractor hears "nobody has thought about this."

Whether a contractor can be bound is a question of contract; counsel should confirm the mechanism before the code claims the coverage.

What counts as a gift?

The good answer is an example in each direction and a rule of thumb: this is fine, this is not, and here is how to tell for the ones in between. The answer that fails is a definition. Nobody at a supplier's event will consult a definition, and everyone will consult the two examples if they remember them.

Can I report anonymously?

This is never about the form but about what happens to the reporter.

A good answer gives the route, who sees it, your protection, and what the organization did to people who retaliated. That last item answers the question, and it can only be given if it has happened.

What protection a reporter has is set by law, not by your policy, and it differs by country: the UK's whistleblowing framework shows the shape of one such regime. Anonymous reporting has limits (an anonymous report cannot be followed up with the reporter, and in some jurisdictions the handling of reports is regulated), and the honest answer says so.

What if my manager approved it?

The good answer is that a manager cannot approve a breach of the code, the route around the manager is section such-and-such, and using it carries no penalty. The answer that fails begins 'in most cases.' The whole document rests on this one answer.

A code that does not contain it is enforced at each manager's discretion, which is to say not a code. The codes of conduct pillar treats this as the test that matters.

Will I be told what happened?

The good answer is yes, within a stated time, to the extent that telling you does not breach someone else's confidentiality, and here is what that extent usually looks like. The answer that fails is "investigations are confidential". People who report and then hear nothing conclude that nothing was done, and they tell others.

Does it apply to the CEO?

The good answer is a fact: yes, here is how the board would enforce it. It also gives a general description of the last time the code was applied to someone senior.

The answer that fails is "the code applies to everyone," when stated as policy. Whether the code reaches the top is also what an outside reviewer looks for.

The Department of Justice's compliance program guidance treats senior accountability as evidence that a program is real.

The person asking has already seen the policy. They want to know whether it is true, and only a record answers that.

What if I am not sure whether something is a breach?

The good answer is a name and an expectation: ask this person, they will answer within this time, and asking is never held against you. The answer that fails is "use your judgment". Judgment is what the person is asking for help with.

What if the rule is wrong?

This is the rarest question and the most valuable. The good answer: tell the owner in writing. It goes into the log that drives the next revision. Here is an example of a rule that changed because someone said so.

An organization with no such example has a code never corrected from below. It is unlikely to be corrected from above.

What each question reveals

Question	The code is missing	Fix
Contractor?	A scope clause with a mechanism	Contract terms, confirmed by counsel
What is a gift?	Examples	Two per rule, in each direction
Anonymous?	A record of protecting reporters	Protect one, visibly
Manager approved it?	The override paragraph	Write it, name the route, promise no penalty
Will I hear back?	A response commitment	Stated time, stated limits
The CEO?	Evidence of upward enforcement	A record, or the honest admission there is none
Not sure?	A named person	One name, one response time
Rule is wrong?	A revision route	The question log, and one example of it working

Questions for the person writing one

Before drafting, and again before publishing.

Before You Publish

Rule you won't enforce on top performer
Incentive that rewards breaking a rule
What last three incidents had in common
Who will answer questions, agreed
What you will remove
How you'll know it worked in a year

Which rule in here am I not prepared to enforce against a top performer?

Find it. Then either remove it, or get a written commitment from whoever would have to enforce it. A rule you would not enforce against the person who matters most is a rule you are asking junior staff to keep on their own.

Which incentive in this organization rewards breaking which rule?

There is always at least one. Name it. The conversation with whoever owns the incentive happens before publication, because after publication the code has already lost. The dynamics are covered in leadership ethics.

What did the last three incidents have in common, and is that in here?

Incidents cluster. If the last three were all about data access under deadline pressure, the code needs a rule and two examples about exactly that, and not a general paragraph about information security.

Who will answer questions, and have they agreed?

A code with an "ask" route that lands on someone who did not agree to it lands nowhere.

What will I remove?

If this is a revision, at least one rule goes. If this is a first draft, decide now which rules are provisional and will be reviewed after a year, so that removal is expected rather than a climbdown.

How will I know in a year whether it worked?

Not completion rates, for the reasons set out in ethics training programs. The honest measures are whether the question log has entries, whether the exception log has been reviewed, whether any decision went differently because of the code, and whether anyone senior has been held to it. If none of those can be answered, decide now what you will do about that, because the answer is likely to be none.

The question nobody asks

Nobody asks, "What happens if I keep quiet?" because everyone knows: nothing, usually; that is the problem.

A code sets rules but does not create willingness to apply them at a cost. Willingness is personal, covered in employee ethics. The code must ensure when someone finds it, the route exists, works, and does not punish them for using it.

Common questions

What if the honest answer to "does it apply to the CEO" is that nobody knows?

Say that, and then find out, from the board. A code whose reach at the top is unknown has a gap that everyone will assume is there anyway, and confirming the mechanism costs one conversation.

Should the floor questions and their answers be published?

Yes, as a short section at the front of the code, in the words people used. It is the part that will be read, and it turns the question log into the document's most useful page.

How often should the author's questions be revisited?

Every revision, and after any incident. The incentive question in particular changes every time the bonus scheme does.